A new ransomware strain that was discovered in early May 2023 has shown a strong resemblance to Royal ransomware. This new strain BlackSuit, primarily targets Linux systems and Windows. Further analysis from cybersecurity company Trend Micro, shows that BlackSuit and Royal ransomware are almost identical in functions, blocks, and jumps.

BlackSuit operates using a double extortion method, which is a common strategy employed by many ransomware groups. The ransomware also employs OpenSSL’s AES encryption process. However, it also incorporates additional command-line arguments and avoids encrypting specific files with certain extensions during the encryption process. The emergence of BlackSuit and its similarities to Royal underscores the ever-evolving nature of the ransomware ecosystem.

There were speculations that the Royal ransomware group was planning to rebrand under a new name following pressure from law enforcement after targeting IT systems in the City of Dallas, Texas. In May, a new ransomware operation called BlackSuit was discovered, leading to belief that it was the rebranded version of Royal. However, a rebranding did not occur, and Royal is still actively conducting attacks while using BlackSuit in limited instances. Cybersecurity professional Yelisey Boguslavskiy, states that the Royal group consists of over 60 cybersecurity experts who were part of the original Conti group or recruited from other elite ransomware groups. They employ both Royal and BlackSuit ransomware. Boguslavskiy suggests that Royal may be testing BlackSuit as a new encryptor or BlackSuit may be a new subgroup of the Royal ransomware family.

While the specific use of BlackSuit remains to be seen, it has been observed in a small number of attacks. BleepingComputer has documented at least three attacks involving the BlackSuit encryptor, with ransoms currently below $1 million. The BlackSuit operation currently has one victim listed on their data leak site, but this could change at any given moment if the encryptor becomes more commonly used. It is advised that network defenders remain cautious as this new operation is linked to the expertise of the Royal group, known for breaching networks and deploying their encryptors. The true nature of BlackSuit, whether a failed experiment or the start of a new subgroup, remains to be seen.

If you are a victim of BlackSuit ransomware, call Alvaka immediately at (949) 428-5000 Ext. 1. We are available 24×7 and can get you started on the proper path to recovery!

Latest Ransomware Related Blogs

Securing data backups against ransomware. The image depicts a cybersecurity theme with a focus on data protection. In the foreground, hands are typing on a laptop keyboard, symbolizing user interaction with technology. Floating above the laptop is a large, glowing white padlock icon, representing secure access or cybersecurity. To the left of the padlock are three smaller icons: a cloud with arrows (representing cloud storage or data transfer), a shield with a checkmark (indicating security or protection), and a globe with an envelope (symbolizing global communication or email security). On the right side of the padlock is a semi-transparent login interface displaying "CYBER SECURITY" with placeholders for a username and password, emphasizing secure user authentication. The background is softly blurred, focusing attention on the icons and laptop interaction. The overall tone conveys the importance of cybersecurity in a connected digital environment.
Incident Response Readiness. The image shows a man sitting at a desk, visibly stressed, with his hands on his head. He is staring at two computer monitors displaying warning messages that read "SYSTEM HACKED," suggesting that his computer system has been compromised. The room appears to be an office setting, with a light background and organized desk supplies. The man seems overwhelmed, likely due to the cyberattack that has disrupted his work.
Canva image. The image shows a close-up of a document labeled "Impact Analysis" with the phrase "Work products to be modified" underneath. A sharpened pencil is positioned diagonally on the document, emphasizing the text. The image suggests an analysis or evaluation process, with the pencil symbolizing planning or marking important points. The context appears to involve reviewing or modifying work processes or products based on the impact analysis findings.
Mitigating DoppelPaymer ransomware effects. The image depicts a person typing on a keyboard, with a digital overlay of cybersecurity elements. There is a semi-transparent shield icon with a padlock in the center, symbolizing security, and other icons related to data protection and technology around it. On the right side, there’s a digital login form interface, showing fields for a username and password. The overall theme of the image appears to be related to cybersecurity and secure online access. The person in the image is wearing a blue shirt, though their face is not visible.
Ransomware Rescue
Contact Alvaka